Security

Password

The first section holds one card with a "Change password" row and two fields, "Current password" and "New password", each with a show/hide toggle. The card's footer reads "At least 8 characters." beside the "Change password" button, which reads "Changing…" while it works.

When the current password is wrong, the field reads "That is not your current password." and nothing changes: a typo never signs you out. When it is right, the new password replaces it, the fields clear, and a confirmation reads "Password changed. Signed out 2 other devices." (or "Nothing else was signed in."); the devices list below updates. The device you are on stays signed in. In the rare case the page cannot tell which device you are on, every device is signed out, this one included, and you land on the sign-in page.

The row's help says it in one line: "Changing it signs out every other device. This one stays signed in." No email is sent on a password change.

A forgotten password is not handled here. The "Forgot?" link on the sign-in page sends a reset code to your sign-in email; the code is valid for ten minutes and works once. A reset replaces the password and signs no device out; use "Sign out everywhere else" below if that is what you meant to do.

Two-factor authentication

The section's lede reads "A second proof at sign-in, from your authenticator app or your inbox." A password sign-in has two steps: the password, then a 6-digit code. "Sign in with an email code" on the sign-in page skips the password and asks only for the code mailed to you.

Authenticator app

The row shows a status, "Enabled" or "Not enabled", and one button, "Enable" or "Disable". Its help names what it takes: codes from a password manager or authenticator app, such as 1Password, Bitwarden or Google Authenticator.

Enabling, step by step:

1. "Enable" opens a setup form.
2. A QR code is shown beside the line "Scan the QR code with your authenticator. If you cannot scan, enter this secret manually:" and the secret itself, in a chip with a copy control. A "Copy otpauth:// URL" link copies the full address: the secret, your sign-in email as the account label and "IntelligenceAds" as the issuer. Scan the code, or paste the secret or the URL, whichever your app takes.
3. Under "Enter the 6-digit code from your app", type the code the app now shows. "Confirm & enable" becomes available at six digits.
4. When the code matches, the row reads "Enabled" and the "Two-factor" fact on the right reads "Authenticator app". When it does not, an error shows above the sections and the form stays open for the next code.

"Cancel" closes the form and leaves the authenticator not enabled. A later "Enable" shows a new secret, so an entry made in your app during a cancelled attempt does not work: delete it and scan again.

"Disable" is one click, with no confirmation and no code asked. Password sign-in goes back to the email code, and enabling again later starts from a new QR code.

At sign-in, with the authenticator enabled, the password step is followed by "Enter your code" ("Open your authenticator app and enter the 6-digit code to continue."). Without an authenticator, the step reads "Check your email" and the code is in your inbox.

Email code fallback

The second row is a switch, "On" or "Off". It is locked while no authenticator is enabled, because the email code is then the only second factor, and unlocks the moment one is. Every account starts with it on.

The switch is a recorded preference and changes nothing at sign-in: with an authenticator enabled, password sign-in asks for the app's code every time, and "Sign in with an email code" sends a code to your address whichever position the switch is in. While no authenticator is enabled, the row's help reads "How your identity is checked at sign-in today. It becomes optional once an authenticator app is set up."

Signed-in devices

The last section is the list of every device that can still reach this account, one row per device, newest first. A device is listed until it is signed out or goes 14 days unused.

"Sign out" asks once, as "Sign out Chrome on macOS" (or "Sign out this device" for an unknown one) beside "Cancel". The device lands on the sign-in page within minutes.

When at least one other device is listed, a footer reads "This device stays signed in." beside "Sign out everywhere else", which asks once as "Sign out 2 other devices". When no row is marked "This device", the action signs out every device, this one included, and sends you to the sign-in page.

The footnote under the list reads "Times mark each device's most recent session renewal, about every 15 minutes while it is in use.", and adds "A session that has not identified its browser is listed as an unknown device." when one is. If the list cannot be read, the section says so ("Your devices could not be read just now.") and keeps the rows already on screen.

The address and the browser name are what the device reported; they are there for you to recognize a device, and nothing is decided from them.

Your account

The card on the right, "Your account", is the same on every account page.

What this page does not do

• It issues no backup codes. The email code is the recovery path: "Sign in with an email code" is open on the sign-in page whether or not an authenticator is enabled.
• It offers no passkey.
• It sends no email. Nothing goes out on a password change, on an authenticator change or when a device is signed out; the account emails are the sign-in code, the email verification code, the reset code and the welcome. Notifications lists them.
• It does not sign out the device you are on; "Log out" in the user menu does that.
• It keeps no history. A device that was signed out or expired is not listed, and nothing says when or from where a past device signed in.
• It does not change the sign-in email.
• It does not confirm "Disable" and asks no code for it.
• The email code fallback switch is recorded and shown; nothing at sign-in reads it.